Score:1

Postfix/Dovecot - Initial Config - Test Email Results - 554 5.7.1 Client host rejected: Access denied

um flag

I sent an email successfully. Can't say the same for receiving. When I attempt to, I get an email saying that the message was blocked with the following diagnostic code:

Diagnostic-Code: smtp; 554 5.7.1 <mail-qv1-f52.google.com[209.85.219.52]>: Client host rejected: Access denied

Went through the Postfix Configuration wizard again by running 'sudo dpkg-reconfigure postfix'. I commented out smtpd_receipient_restrictions. Ran 'sudo systemctl restart prefix'. Looked at other posts, but they mostly say "Relay access denied", which seems different.

Here is the postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
compatibility_level = 2
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = all
mailbox_size_limit = 0
mydestination = fullstack.equityentity.com, mail.equityentity.com, equityentity.com, localhost.equityentity.com, localhost
mydomain = equityentity.com
myhostname = fullstack.equityentity.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
policyd-spf_time_limit = 3600
readme_directory = no
recipient_delimiter = +
relayhost =
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.equityentity.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.equityentity.com/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_use_tls = yes
virtual_alias_domains = $mydomain
virtual_alias_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_catchall_maps.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/sql/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/sql/mysql_virtual_mailbox_maps.cf, proxy:mysql:/etc/postfix/sql/mysql_virtual_alias_domain_mailbox_maps.cf
virtual_transport = lmtp:unix:private/dovecot-lmtp

And the doveconf -n:

# 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.7.2 ()
# OS: Linux 5.4.0-144-generic x86_64 Ubuntu 20.04.6 LTS ext4
# Hostname: fullstack.equityentity.com
auth_mechanisms = plain login
first_valid_uid = 150
last_valid_uid = 150
mail_gid = mail
mail_location = maildir:/var/vmail/%d/%n
mail_privileged_group = mail
mail_uid = vmail
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}
postmaster_address = [email protected]
protocols = " imap lmtp pop3"
service auth-worker {
  user = vmail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
  user = dovecot
}
service imap-login {
  inet_listener imap {
    port = 143
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
}
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.equityentity.com/fullchain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
userdb {
  args = /etc/dovecot/dovecot-sql.conf.ext
  driver = sql
}

Any ideas?

anx avatar
fr flag
anx
You likely have additional overrides set in master configuration - use `postconf -M` to generate a neatly formatted dump of that file. (About the already shared config: That is the expected `-n` output, merely the headings spell out a different option than apparently used.)
Score:1
fr flag
anx

You have more options and/or references to additional policy daemons/milters in your master.cf, and one of those could be denying access. I know your main.cf dump does not show out the full picture because it references the non-default service name policyd-spf.

Investigate additional overrides (-o option=value) of the port 25 (smtp inet) service.


Also investigate why you have the non-default broken_sasl_auth_clients=yes. Its not dangerous by itself, but if you need it, you are probably accommodating very unusual clients, which might not mix well with running a mail server open to public internet.

Anthony Mallgren avatar
um flag
You are right. I commented out smtpd_client_restrictions=permit_sasl_authenticated,reject in master.cf and it began working. I'll have to figure out SASL. Thank you!
anx avatar
fr flag
anx
@AnthonyMallgren you may want to keep SASL disabled (smtpd_sasl_auth_enable=no) for port 25 (smtp inet), but mandatory (smtpd_sasl_auth_enable=yes + smtpd_client_restrictions=permit_sasl_authenticated,reject) on port 465 (smtps inet) - that way you will have less potential for unintended access/restrictions resulting from trying to serve two very different sorts of clients with a single restriction set.
Anthony Mallgren avatar
um flag
Thank you. I'll take a look at that when it is up and running. I hope you'll know I tried to up vote your answer, but I don't have enough experience points.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.